Remote Access Tools

Issue/Question

How does the University manage 3rd party remote access tools?

Environment

• USD Network
• USD Computers
• Cybersecurity
• Ransomware

Cause

This policy provides a framework for governing the use of Remote Access Tools within the university environment, thereby reducing the risk of ransomware attacks and other cybersecurity incidents. It emphasizes the importance of security, compliance, and user awareness in safeguarding the university's digital assets and ensuring uninterrupted academic and administrative operations.

Resolution

1. Prohibited Remote Access Tools:
   a. By default the use of Remote Access Tools on the USD network or computer systems is unauthorized and prohibited.
   b. Only tools approved by the university's IT department may be utilized for remote access purposes.
   c. Approval of 3rd party tools is subject to change at any time based the risk profile the tool represents. 
    
2. Approval Process:
   a. Individuals or departments seeking to deploy a Remote access tool for legitimate business or educational purposes must submit a request to the university's IT department.
   b. The IT department will evaluate the proposed remote access tool based on security, compliance, and operational considerations before granting approval.
   1. Approved RATs
      • VPN/RDP
      • Bomgar
      • Microsoft Teams
      • Webex
      • Zoom
         
3. Monitoring and Compliance:
   a. The university reserves the right to disable the functionality of non-approved tools.
   b. Any unauthorized use of remote access tools is strictly prohibited.
   c. This policy is subject to SDBOR policy on remote work.
    
4. Security Measures:
   a. Approved tools must adhere to established security protocols and encryption standards to safeguard sensitive data during transmission.
   b. Regular security assessments and updates must be conducted to mitigate vulnerabilities and ensure the integrity of remote access systems.
   c. Use of remote access tools internationally is restricted.
    
5. Education and Awareness:
   a. The university will provide training and awareness programs to educate users on cybersecurity risk.
   b. Users are encouraged to report any suspicious activity or potential security incidents related to remote access tools promptly.